Password Strength Checker

The Password Strength Checker analyzes any password and rates it on multiple dimensions: bits of entropy (mathematical unpredictability), estimated crack time against modern GPU attacks, match against common password lists (the most-used passwords that attackers try first), and pattern detection (sequential characters, repeated letters, keyboard walks like qwerty). Unlike simple "length check + has uppercase" tools, this uses zxcvbn — a real password strength estimator built by Dropbox, analyzing against 30,000+ common passwords, common names, dates, keyboard patterns, and leet-speak substitutions.

Password strength matters because most account compromises come from reused or weak passwords cracked in bulk after database breaches. An 8-character password with mixed case and digits sounds secure — but top password-cracking rigs can try billions per second on leaked hashes. The checker tells you: "your password would be cracked in 12 minutes" — not "weak" vs "strong". It also flags if your password matches a known breach from Have I Been Pwned (via k-anonymity API — only the first 5 chars of the hash are sent, so the password itself stays private). This tool runs entirely in your browser for passwords you enter; breach checks use k-anonymity so the full password never leaves your device.

Password strength is measured in bits of entropy — the logarithm (base 2) of the number of possible passwords an attacker must try to be guaranteed to crack yours.

Entropy formula:

``
entropy = length × log2(alphabet_size)
``

Examples:

| Password | Length | Alphabet | Entropy | Crack time (GPU) |
|---|---|---|---|---|
| 12345 | 5 | 10 (digits) | 16.6 bits | < 1 second |
| password | 8 | 26 (lowercase) | 37.6 bits | < 1 second (in dictionary) |
| Password1 | 9 | 62 (mixed case + digits) | 53.6 bits | ~ 2 hours (but in common list) |
| k7#mP3!xQ | 9 | 94 (all printable) | 59.0 bits | ~ 6 hours |
| k7#mP3!xQvR9@ | 13 | 94 | 85.2 bits | ~ 500 years |
| correct-horse-battery-staple | 28 | 26 | 131.6 bits | ~ 10^20 years |

But entropy alone is misleading:

A password with high theoretical entropy but in a common password list is actually weak. Attackers try common passwords first. Summer2024! has decent entropy by formula (~62 bits) but is weak in practice — attackers try seasonal patterns + year + special character.

zxcvbn algorithm:

zxcvbn goes beyond entropy formula:

1. Dictionary match — check against 30,000+ most common passwords.
2. Name match — check against common first/last names.
3. Year match — 1900-2050 are common (birthdays, graduation years).
4. Repeat pattern — aaa, 121212, abcabc.
5. Sequence — abc, 123, qwerty (keyboard walks).
6. L33t speak — substitute @ for a, 3 for e, ! for i.
7. Date pattern — 1/1/2000, 01012000, jan2000.

Score from 0 (very weak) to 4 (very strong):

- 0: too guessable, crackable in < 10^3 attempts
- 1: very guessable, < 10^6 attempts
- 2: somewhat guessable, < 10^8 attempts (online attacks maybe OK, offline NO)
- 3: safely unguessable, < 10^10 attempts (offline attacks slowed)
- 4: very unguessable, > 10^10 attempts (offline attacks impractical)

Modern crack speeds (2026 GPU rig):

- NTLM hash: ~ 1 trillion attempts/sec
- MD5: ~ 200 billion attempts/sec
- SHA-256: ~ 50 billion attempts/sec
- bcrypt (properly configured): ~ 100,000 attempts/sec — why you should use bcrypt for password storage

Breach checking (Have I Been Pwned):

Pwned Passwords API uses k-anonymity. Process:

1. Your browser computes SHA-1 of the password.
2. Sends only the first 5 chars of the hash (e.g., 5BAA6).
3. API returns all SHA-1 hashes starting with those 5 chars, plus breach counts.
4. Your browser matches the full hash locally.

The full password never leaves your device. Safe to use.

NIST password guidelines (SP 800-63B):

- Minimum 8 characters, allow up to 64+
- Permit all printable characters including spaces
- DO NOT require forced complexity (uppercase + symbol + digit)
- DO NOT force periodic rotation
- DO check against breach databases (like Have I Been Pwned)
- DO rate-limit login attempts

zxcvbn vs simple length check: Simple meters say Password1! is strong (8+ chars, mixed case, digit, symbol). zxcvbn knows it is in the common password list and rates it weak. zxcvbn is realistic; simple meters are optimistic.

Pattern detection vs pure entropy: Pure entropy formula says 131b2o3r4i5n6g is high entropy (14 chars, mixed). But it is a predictable pattern (boring with numbers between letters). Pattern detection catches this; pure entropy does not.

Strength checker vs Password Generator: Checker evaluates existing passwords. Generator creates new ones. Use together: generate a random password, check its strength, use it. See our Password Generator.

zxcvbn vs NIST password rules: zxcvbn is a technical measurement. NIST provides human-usable guidelines (8+ chars, check breaches, no forced rotation). Both inform good password practice.

Local check vs online breach check: This tool does both. Local strength analysis (zxcvbn) — purely in your browser. Breach check — uses k-anonymity so only first 5 chars of hash sent. Your password never fully leaves your device.

Password vs Passphrase vs Passkey: Password is a short random string. Passphrase is a longer memorable sequence of words. Passkey is a cryptographic key (WebAuthn) that replaces passwords entirely. Use passkeys where supported (increasingly common); otherwise passphrases for master passwords, random passwords for accounts.